Hacker News Reader

Comment by tptacek | Hacker News Reader

I'm having a hard time getting my head wrapped around the idea of relying on Gmail (or any other online identity provider) without enabling 2-factor authentication. The best way to avoid this kind of "AI hell" is just to take control of your own account security and set up some additional factors.

View on HN

Google will still lock you out with 2fa. It’s pretty bad

Even with a FIDO2/U2F/WebAuthn key?

If so, yeah that's pretty bad..

Yeah I got locked out dispite having printed codes and authy setup. Lasted a day or so

That's a scary thought, being locked out of a primary email address despite taking security seriously.

I currently have it secured with my backup codes (printed and stored in a secure location), as well as two Yubikey (one primary, one backup).

I'd be seriously angry if Google locked me out of my account.

Recently i wanted to setup a shared gmail account with some people.

Even with 2FA setup, correct password correct TOTP, it did not let them in because it was suspicious. I also checked "it was me" in all their security alerts. It would only let the person in with sms based 2fa, which was a pain.

One of the main reasons why I don't want to activate 2FA in my Google account is precisely because while I don't have highly sensitive data in that account, I do have lots of convenient things that I need in a day-to-day basis, so I wouldn't want to be locked out of my account. And 2FA provides more ways in which this can happen (for example, the smartphone with the authenticator program breaks). So now the option is either having the risk of being locked out because of 2FA, or having the risk of being locked out because of the AI being "angry" at us for not activating 2FA?

> for example, the smartphone with the authenticator program breaks

There are 3rd party authenticator apps (not Google Authenticator, though) that will allow you to seamlessly back up and restore the 2nd authentication factor, even to a different device. Ideally, it then becomes no less convenient than a password.

Unless you have an older account, rarely used except to forward email to another address, and google unilaterally decides to lock you out without telling you they're changing their policy. Apparently the big google brain decided somebody other than myself guessed my 40 random char password. I've long decided I will never be able to login to my gmail account.

I forget now why I was originally trying to login. I may have been trying to setup 2fa even. Not gonna happen now.

Except Google does not honor the recovery account. Even with access to the recovery code, Gmail just ignores it.

For some people, anonymity of use has a higher priority.

I've largely given up on personal use of email, full stop.

Have had an account since the 1980s.

Reply on news.ycombinator.com